[LTS 9.2] CVE-2024-26585, CVE-2024-26668 #623
Conversation
jira VULN-8187 cve CVE-2024-26585 commit-author Jakub Kicinski <kuba@kernel.org> commit e01e393 upstream-diff No actual difference from the upstream patch, but required manual conflicts resolution due to differences in neighbouring code Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do. Reported-by: valis <sec@valis.email> Fixes: a42055e ("net/tls: Add support for async encryption of records for performance") Signed-off-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit e01e393) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
jira VULN-8197 cve CVE-2024-26668 commit-author Florian Westphal <fw@strlen.de> commit c9d9eb9 upstream-diff Used `limit' struct instead of `priv' because of missing 369b6cb. Also added casts to `u64' where appropriate as inspired by the RH's LTS 9.4 backport of this patch embedded in 270e20b. Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this rather than having incorrect ratelimit. Fixes: d2168e8 ("netfilter: nft_limit: add per-byte limiting") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> (cherry picked from commit c9d9eb9) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
CVE-2024-26581This looks like the fun of I'll take a look at this and get back to you on the projected list i'm having some issues with my Please remove the CVE from the summary line, please leave the details though. |
pvts-mat
changed the title
|
I think check-upstream-fixes fails because you did not push your branch locally. I'll fix this tomorrow morning. |
Marchin is an external commiter which must be done from remote forks, only CIQ employees can make a local branch. |
4 participants
[LTS 9.2]
CVE-2024-26581 VULN-8184
CVE-2024-26585 VULN-8187
CVE-2024-26668 VULN-8197
Commits
CVE-2024-26581
The bug doesn't apply to Rocky Linux LTS 9.2
The patch deals with how the
nft_rbtree_gc_elem(…)is called. It fixes the change in f718863 (1), which is not present inciqlts9_2history. The functionnft_rbtree_gc_elem(…)itself was introduced in c9e6978 (2) which is missing fromciqlts9_2history either. From c9e6978's message:It doesn't have any equivalent in the older versions, as it is associated with the changes to the
__nft_rbtree_insert(…)introduced in c9e6978 (2) (the only usage of~nft_rbtree_gc_elem(…)). See the comparative timeline of the affected filenet/netfilter/nft_set_rbtree.c:CVE-2024-26585
bce037a:
CVE-2024-26668
16e1adf:
kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Reference
kselftests–ciqlts9_2–run1.log
kselftests–ciqlts9_2–run2.log
Patch
kselftests–ciqlts9_2-CVE-batch-9–run1.log
kselftests–ciqlts9_2-CVE-batch-9–run2.log
Comparison
The tests results for the reference and the patch are the same.